As the year comes to an end, consider whether your business is required to make an annual privacy policy update and share updated consumer metrics under the CCPA.
Annual Notice Update
Businesses subject to the CCPA are also required to update their online privacy policies “at least once every 12 months.” For many businesses that make these updates at the end of the calendar year, that deadline may be approaching.
Additionally, the privacy policy update may be an opportunity to look around the corner to the notice requirements in the California Privacy Rights Act (which will replace the CCPA), and the new privacy statutes in Colorado and Virginia, which all go into effect in 2023.
Consumer Reporting Metrics
Also, the CCPA Regulations require that certain businesses post their consumer request metrics. These reporting obligations, outlined in Section 999.317(g) of the CCPA Regulations, apply to any business that is subject to the CCPA and that knows or reasonably should know that it, alone or in combination, buys, receives for the business’s commercial purposes, sells, or shares for commercial purposes the personal information of 10,000,000 or more California residents in a calendar year.
The metrics run on the calendar year (January – December), and they must be posted by July 1, either in the Privacy Policy or elsewhere online with a link in their Privacy Policy, the following metrics for the previous calendar year:
- The number of requests to know that the business received, complied with in whole or in part, and denied;
- The number of requests to delete that the business received, complied with in whole or in part, and denied;
- The number of requests to opt-out that the business received, complied with in whole or in part, and denied; and
- The median or mean number of days within which the business substantively responded to requests to know, requests to delete, and requests to opt-out.